This could be the case for literally any E2EE service that controls key distribution (including WhatsApp, Signal, etc.), especially when there's no way to verify key fingerprints (here Signal differs because it does have a way, and it's open source so you can be more confident that it's not BSing you).
It's shocking to me how often this is glossed over when discussing E2EE services: you still must trust the platform.
It's shocking to me how often this is glossed over when discussing E2EE services: you still must trust the platform.